Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #256

#256

From: John Slade
Date: Mon, 02 Aug 2010 01:31

45 lines
4112 bytes

On 8/1/2010 4:09 PM, David H. Lipman wrote:
> From: "Dustin"<bughunter.dustin@gmail.com>
>
> <  snip>
>
>>>            I don't know why you would find it funny because a
>>> virus writer will use anything to hide a virus. What smarter way
>>> is to hide them in each and every folder in "system volume
>>> information"? I do believe that what the system had was a
>>> variant of the Virtumonde trojan. If you did research on malware
>>> then you know virus writers will take existing malware and
>>> modify it. I found one thing to be true in the world of malware,
>>> NOBODY knows everything about every malware variant out there.
>>> You can believe me or not, it doesn't matter.
>
> | Well, I found it funny from the point of view of a former virus writer
> | turned whitehat. Does that make any sense to you?
>
> | Why would I spend the time to hide a virus in a folder, when I could
> | choose files? You could just delete me if I stored myself in a folder
> | in a binary format alone. If I reside in your files instead, I'm alot
> | harder to deal with.
>
> | I know some virus writers have used existing code and modified that
> | yes. However, the majority of the crap I've seen passing for malware
> | these days typically isn't actually viral in nature. A virus is no
> | accident, ya see.
>
> | It's entirely possible the individual does have a virut varient, I
> | haven't seen the sample to confirm or deny that. Based only on what Ant
> | has written up about it tho, doesn't seem to indicate virut; but
> | something possibly forked from the same original codebase.
>
> | How as a virus would I be able to hide if you examined the drive from a
> | system that didn't start off of it? It's a rhetorical question... :)
>
>
> The important aspect is one of NTFS permissions.  More than just the average malware can't
> access "system volume information" and certainly NOT the Vundo family (including Virtumone
> adware).
>

      As far as you know...

John

Technical Details

Message-ID: <8ep5o.33912$o27.16637@newsfe08.iad>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post02.iad.highwinds-media.com!newsfe08.iad.POSTED!839ee1e6!not-for-mail

References:

<i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <i34v290rg7@news5.newsguy.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!post02.iad.highwinds-media.com!newsfe08.iad.POSTED!839ee1e6!not-for-mail
From: John Slade <hhitman86@pacbell.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.11) Gecko/20100711 Thunderbird/3.0.6
MIME-Version: 1.0
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
References: <i2lolb$s5r$1@news.eternal-september.org> <i2mveh$ogf$1@news.eternal-september.org> <i2nfok0tgi@news4.newsguy.com> <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <Xns9DC7B81E7836AHHI2948AJD832@69.16.185.250> <i34v290rg7@news5.newsguy.com>
In-Reply-To: <i34v290rg7@news5.newsguy.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 100801-1, 08/01/2010), Outbound message
X-Antivirus-Status: Clean
Lines: 47
Message-ID: <8ep5o.33912$o27.16637@newsfe08.iad>
NNTP-Posting-Date: Mon, 02 Aug 2010 01:31:48 UTC
Date: Sun, 01 Aug 2010 18:31:47 -0700

Reply to Parent Message